Relax-And-Recover Vulnerability — Ubuntu Security Update (USN-8988-1)
USN-8988-1 fixes CVE-2024-23301 in Relax-and-Recover (ReaR) on Ubuntu: with GRUB_RESCUE enabled, the generated initrd was created world-readable, leaking its contents (CWE-540-level exposure; CVSS 5.5). Update: sudo apt update && sudo apt upgrade rear and regenerate any rescue image.
SharedLicense लाइसेंस के तहत इसका अर्थ
A world-readable rescue initrd contains system configuration, network details and potentially credentials — leaking it hands an attacker a map of the boot and recovery environment.
-
USN-8988-1
Publication date
3 November 2026
Overview
Relax-and-Recover could be made to expose sensitive information.
Releases
Packages
- rear – Bare metal disaster recovery and system migration framework
Details
It was discovered that Relax-and-Recover created a world-readable initrd
when GRUB_RESCUE was enabled. A local attacker could possibly use this
issue to obtain sensitive information.
It was discovered that Relax-and-Recover created a world-readable initrd
when GRUB_RESCUE was enabled. A local attacker could possibly use this
issue to obtain sensitive information.
Update instructions
In general, a standard system update will make all the necessary changes.
Learn more about how to get the fixes.
The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
|
22.04
LTS jammy |
rear – | ||
|
20.04
LTS focal |
rear –
2.5+dfsg-1ubuntu0.1~esm1 Ubuntu Pro |
||
|
18.04
LTS bionic |
rear –
2.3+dfsg-1ubuntu0.1~esm1 Ubuntu Pro |
||
References
अक्सर पूछे जाने वाले प्रश्न
What is CVE-2024-23301?
Who is affected?
How do I apply the fix?
What could an attacker do with the initrd?
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें